CVE-2026-110866GHSA-2frq-pm48-6j4h
Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request
renovatebot renovate
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 44.61.3renovateCVE List
- 15.5.0renovate-ceCVE List
- 15.5.0renovate-ee-serverCVE List
- 15.5.0renovate-ee-workerCVE List
- 15.5.0mend-renovate-ce helm chartCVE List
- 10.5.0mend-renovate-enterprise-edition helm chartCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.
Text from CVE List
Affected versions 6
- renovateaffected: all versions before 44.61.3CVE List
- renovate-ceaffected: all versions before 15.5.0CVE List
- renovate-ee-serveraffected: all versions before 15.5.0CVE List
- renovate-ee-workeraffected: all versions before 15.5.0CVE List
- mend-renovate-ce helm chartaffected: all versions before 15.5.0CVE List
- mend-renovate-enterprise-edition helm chartaffected: all versions before 10.5.0CVE List